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Abstract — Many entanglement distillation schemes use either 
universal random hashing or breeding as their final step to obtain 
almost perfect shared EPR pairs. In spite of a high yield, the 
hardness of decoding a random linear code makes the use of 
random hashing and breeding infeasible in practice. In this pilot 
study, we analyze the performance of the recurrence method, 
a well-known entanglement distillation scheme, with its final 
random hashing or breeding procedure being replaced by various 
efficiently decodable quantum codes. Among all the replacements 
investigated, the one using a certain adaptive quantum low 
density parity check (QLDPC) code is found to give the highest 
yield for Werner states over a wide range of noise level — the 
yield for using this QLDPC code is higher than the first runner up 
by more than 25% over a wide parameter range. In this respect, 
the effectiveness of using QLDPC codes in practical entanglement 
distillation is illustrated. 

Index Terms — Adaptive Algorithm, Breeding Method, Entan- 
glement Distillation, Quantum Low Density Parity Check Code, 
Random Hashing, Recurrence Method 



I. Introduction 

Bipartite entanglement distillation, or entanglement distil- 
lation for short, describes a general class of methods for 
obtaining copies of high fidelity Bell states shared by two 
parties from a collection of initially shared entangled particles 
using local quantum operations and classical communication. 
Many entanglement distillation methods have been developed. 
For instance, two cooperative players, Alice and Bob, may 
compare their measured error syndromes of their shares of 
the quantum particles using a pre-determined quantum error- 
correcting code (QECC) and then perform the necessary error 
recoveries. Alternatively, they may apply an entanglement 
distillation (ED) procedure such as the well-known recurrence 
method Q), 0. More precisely, by two-way local opera- 
tions and classical communications (LOCC2), Alice and Bob 
discard those particles whose measurement results are not 
consistent with that of the corresponding Bell states. Thus, 
two-way ED can be regarded as a carefully designed quantum- 
error-detection-code-based error rejection method. 

QECC- and ED-based entanglement distillation methods 
can be extended in many ways such as the introduction 
of adaptation 0, 0, 0, (6|, and various breeding 
methods |8|, |9|, 1 1 1 . Most studies so far focus on improving 
the yield or the maximum error-tolerable rate under various 
conditions. Most of them use either the random hashing 
method introduced in Ref. or variations of the breeding 



method proposed in Refs. and as their last step. (There 
are a few exceptions such as the distillation methods reported 
by Chau [3] and Cirac et al. ifTTI . However, the yield of the 
former drops dramatically as the noise level of the initially 
shared EPR pairs increases and the latter gives at most one 
EPR pair at the end.) 

The use of random hashing or breeding as the last step 
of entanglement distillation is not surprising. Both methods 
make use of random stabilizer quantum error-correcting codes 
whose error syndromes can be measured using a simple and 
efficient quantum circuit plus a few ancillas. Also, Vollbrecht 
and Verstraete found that the optimal yield protocol to distill 
identical copies of high fidelity Werner states among those us- 
ing local unitary operations and Bell basis measurements uses 
a certain carefully designed breeding method [8|. Moreover, 
Fig. 3 in Ref. [8] shows that their optimal protocol narrowly 
beats the universal random hashing method when the fidelity 
of the Werner state is high. Third, the yields of both random 
hashing and breeding methods are easily computable. Finally, 
in the limit of an arbitrarily large number of shared qubits 
remaining before applying the random hashing or the breeding 
procedure, the fidelity of the finally distilled EPR pairs, if 
any, will be arbitrarily close to one. These nice features will 
not be present if the universal random hashing or breeding 
procedures are replaced by a general easily decodable code of 
finite length. Nonetheless, this is what Alice and Bob have to 
do in order to make the distillation method practical because 
decoding random linear codes (associated with the hashing or 
breeding protocol) is an NP-complete problem fl2l . fl3l . 

Among the entanglement distillation methods in the litera- 
ture, one of the easiest and most well-known is the recurrence 
method, which can tolerate up to 50% quantum error rate 
upon repeated application (Tj, 0. In this pilot study, we 
focus on the yield of applying the recurrence method with the 
final random hashing or breeding procedures being replaced 
by various efficiently decodable QECCs (of finite length). 
We also investigate a more aggressive strategy in which the 
efficiently decodable QECC is adaptively chosen according to 
error syndrome measurement results as they become available. 
The efficiently decodable QECC is used adaptively either to 
correct erroneous qubits like a QECC-based scheme or to 
reject erroneous ones like an ED-based scheme. Since the 
fidelity of the distilled EPR pairs may no longer be arbitrarily 
close to one, to analyze the yield, we have to compute the 
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number of perfect EPR pairs given that the quantum error 
rate of the distilled pairs is less than or equal to a certain 
threshold. Actually, this criterion, which is a straightforward 
generalization of a similar criterion used in the study of 
classical codes [14|, has already been adopted by MacKay 
et al. in their study of the performance of certain quantum 
low density parity check (QLDPC) codes |15|. We find that 
among all the codes we have investigated and over almost all 
ranges of initial error rates for the Werner states, the yield 
of the resulting ED procedure for a certain novel adaptive 
QLDPC stabilizer code is better than the yields of all the other 
efficiently decodable codes we have investigated (by at least 
25%). 

We begin by stating the detailed procedure of our 
recurrence-method-based ED procedure and the figure of merit 
used in our study in Sec. [n] Since our ED procedure may 
make use of a novel QLDPC code, we spend the whole of 
Sec. Hn] discussing the rationale behind using this code as well 
as its construction and efficient decoding. We also write down 
a detailed procedure of how to use the QLDPC code as one of 
the possible final steps to distill entanglement in an adaptive 
way there. Then we study the performance of our scheme to 
distill almost perfect EPR pairs from a set of Werner states in 
Sec.[lV] In particular, among all the practical methods we have 
studied, the best yield under most circumstances is obtained by 
replacing the computationally intractable random hashing or 
breeding methods by a certain adaptive QLDPC code. Finally, 
we conclude in Sec. [V] by suggesting some possible future 
works. 

II. Entanglement Distillation Method Used And 
Figure Of Merit 

We study the performance of repeated rounds of the recur- 
rence method (TJ, @ combined with an efficiently decodable 
code. More precisely, Alice and Bob apply r rounds of the 
recurrence method for some r = 0,1,2,... before finally 
applying an efficiently decodable code. And in each round 
of recurrence, they randomly pair up their remaining share of 
qubits and measure the syndrome of the parity check X <g> X, 
Y <E)Y or Z ® Z for each pair where the unitary operations 
X, Y, Z are given by 
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respectively. They keep the remaining particles in each pair 
only if their measured syndrome is consistent with that given 
by two perfect EPR pairs each in the state \^> + ) = (|00) + 
1 1 1} ) / a/2- Whereas for the efficiently decodable codes, we 
choose the followings in this study: the [[(4* — l)/3, (4* — 
l)/3 — 2t, 3]] quantum Hamming codes over the field GF(4), 
the [2* — 1, 2* — 1 — t, 3] classical Hamming codes over GF(2), 
the [[2* — 1, 2* — 1— 2i, 3]] Calderbank-Shor-Steane (CSS) codes 



constructed from the classical Hamming codes over the field 
GF{2), the [2*, 2* - 2t, 5] two-error-correcting BCH classical 
code, the [2t + 1, 1, 2t + 1] classical majority vote code, and 
a (8, 16)-regular QLDPC code with codeword size 960 to be 
reported in Sec. [HI] (Note that we include a few classical codes 
in this study because occasionally it is more effective to use 
them for part of the quantum error correction procedure. For 
instance, the last step used in the most error tolerant two-way 
prepare-and-measure-based quantum key distribution scheme 
known to date uses the classical majority vote code |3|. A few 
high performance degenerate quantum codes are constructed 
by concatenating classical codes with quantum codes [16|, 
lUTl .) Our collection of efficiently decodable codes studied 
includes a few high rate quantum and classical codes that cor- 
rect one to two quantum or classical errors. We do not include 
multiple-error-correcting quantum codes because either their 
rate is low or their decoding method is complicated. 

As we have mentioned in Sec. U the average fidelity of the 
resulting shared |4' + )'s distilled by the above methods cannot 
be arbitrarily close to one. And we follow MacKay et al. by 
demanding that the quantum error rate of the distilled |4' + )'s 
be less than or equal to a fixed small threshold parameter 
P(a lfT31 . Fortunately, we find that the conclusions of our 
study do not sensitively depend on the choice of p t h\ and for 
simplicity, we set j>th = 2.0 x 10 -5 . In fact, this choice is 
consistent with the bit error rate commonly used to compare 
the performance of classical error-correcting codes lfl4l . Note 
that our choice of the threshold quantum error rate p^ implies 
that the entropy of the distilled |$ + )'s must be less than or 
equal to -(l-p th ) log 2 (l-p th )-pth log 2 (p t h/3) ~ 3.7xl0~ 4 . 

The yield of a scheme is defined as the number of shared 
perfect | \E' + ) 's distilled divided by the number of initially 
shared imperfect pairs in the limit of an arbitrarily large 
number of initially shared pairs. And for simplicity, we study 
the yield in the event that each initially shared pair is in the 
Werner state 



a - Po )|*+x* + | + y (!*->(*- 
|$+X$+| + |$"X$"|) , 



(2) 



where po is the quantum error rate of the initially shared pairs 
and |* ± ) = (|00) ± |H))/V2, |$ ± > = (|01) ± |10»/V2 are 
the four maximally entangled Bell states. 

For a fixed value of po, we may maximize the yield of 
our recurrence-method-based ED procedure by varying the 
number of rounds of recurrence and the actual parity check 
used in each round. And we use this optimized yield D (or 
yield for short in case there is no ambiguity possible) as the 
figure of merit to compare the efficiency of different efficiently 
decodable codes in the last step of our recurrence-method- 
based ED procedure. Finally, we emphasize that the number of 
rounds of recurrence and the actual parity check used in each 
round is a function of p and the final efficiently decodable 
code used. 
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III. Adaptive Quantum Low Density Parity Check 
Code And Belief Propagation Decoding 

A. Why Use Adaptive QLDPC Code 

The rationale behind using adaptive QLDPC codes in an ED 
procedure is simple. Since both QECC- and ED-based schemes 
use QECC codes, it is instructive to investigate methods that 
can adaptively locate the erroneous qubits and perform the 
necessary error recovery or error rejection. That is to say, Alice 
and Bob first pick a stabilizer QECC C and they decide to do 
one of the followings according to their measured syndromes: 
1) to discard or to apply error correction to a particular qubit; 
or 2) to replace C by a compatible stabilizer code C formed 
by appending a few more parity checks to C so as to hope to 
more precisely locate the erroneous qubits at the expense of a 
lower yield. 

QLDPC codes are particularly suited for this purpose for 
a number of reasons. First, their parity check matrices are 
sparse so that their average error-correcting capabilities do not 
in general change greatly with the deletion of a few qubits. 
Second, QLDPC codes can be efficiently constructed [15], [ 18 1 
and efficient approximate decoding algorithms such as belief 
propagation for classical low density parity check codes (or 
LDPC codes for short) £19), EB, ED can be readily extended 
to QLDPC codes 11221 . 1231 . Finally, families of compatible 
QLDPC codes exist and are easily constructible lfT31 . [22 1. 
For this reason, we use them to replace the random hashing 
code in entanglement distillation. 

B. Constructing Quantum Low Density Parity Check Codes 

A QLDPC code can be defined and represented in a way 
very similar to a classical LDPC code. 

Definition 1: A quantum low density parity check 
(QLDPC) code is a quantum stabilizer block error-correcting 
code over a finite field GF(q) that has a sparse parity check 
matrix. In particular, a (d v , d c ) -regular QLDPC code has a 
sparse parity check matrix H with a constant column weight 
d v and a constant row weight d c [15|, [18|. 

For example, by explicitly writing down their parity check 
matrices, one can see that the quantum error-detection-code 
associated with each round of recurrence method (TJ, O and 
the Leung and Shor method @, Q are (1,2)- and (2,4)- 
regular QLDPC codes, respectively. (In some sense, these two 
codes are atypical QLDPC codes as they are composed of 
tensor products of block codes of sizes 2 and 4, respectively.) 
Actually, a large number of QLDPC codes exist for a suf- 
ficiently large block code size. Existing ways to construct 
them include the so-called bicycle and unicycle constructions 
by Mac Kay et al. lfl5l . group theoretical construction by 
Camaraef a/. 1181 . algebraic-combinatorial-based construction 
of quasi-cyclic CSS QLDPC code by Hagiwara and Imai [24|, 
classical quasi-cyclic LDPC -based construction of QLDPC 
codes by Hsieh et al. |25l . finite geometric construction 
by Aly J26), and BCH- and finite geometry LDPC code- 
based asymmetric QLDPC codes construction by Sarvepalli 
et al. [27 1 . It is remarkable that the error-correcting capability 



of some of these QLDPC codes are better than the Gilbert- 
Varshamov rate for binary CSS codes lfl5l . 

The GF(A) stabilizer QLDPC code we used in this study is 
a simple but important extension of the bicycle construction 
by MacKay et al. in Ref. fl3). Actually, our QLDPC code 
construction works for any q-axy code where q = p v is a 
prime power. So, we report this more general construction 
below. This construction is based on our earlier unpublished 
work IF221 . 

We follow the notation of Ashikhmin and Knill ll28l by 
defining the unitary operators X a and Z\> acting on a q- 
dimensional Hilbert space by 

X a :\i)^\i + a) (3) 

and 

Z b : \i) ,— > \i) (4) 

for all a,b,i £ GF(q), where w p is the pth root of unity and 

Tr(i) =i + i p + ■■■+ e GF(p) (5) 

is the absolute trace of i £ GF(q). Note that all arithmetic 
inside the state ket and in the exponent of m p is performed in 
the finite field GF(q). We also identify the unitary operator 
X a Z\, with a + buj q 2 £ GF(q 2 ) where uj q 2 is a fixed 
primitive element in GF(q 2 ). Using this identification, we may 
abuse our language by saying, for example, that a qudit has 
experienced an error a + buj q 2 . 

To construct a [n, n— k] bicycle GF(q 2 ) stabilizer QLDPC 
code with row weight d c , we first select a random (n/2) x 
(n/2) cyclic GF(q 2 ) sparse-matrix Cb with row weight d c /2. 
That is to say, the elements of the matrix Cb satisfy (Cs)ij = 
(Cb)^ = on-j for some a^j £ GF(q 2 ), where (aj)^ is a 
sparse vector with weight d c /2. So, for 1 < i, i',j < n/2, 

(Cnji,i + i>-j = (Cb)i'j (6) 

and 

(Cn)i',i+i<-j = (CB)ij, (7) 

where Cj denotes the transpose of Cb- We define the (n/2) x 
n bicyclic matrix H by 

H=[Gb,C%]. (8) 

Clearly, rows of this bicyclic matrix H are mutually orthogonal 
to each other with respected to the skew-symmetric inner 
product 

(a + buj q 2 \c + duj q 2 ) = Tr (ad - be) e GF(p) (9) 

for all a, b,c,d £ GF(q), irrespective of whether Cb is sparse 
or not. Since 

X c ZdX a Zi, = zup 9 ' q ^ X a Zi,X c Zd, (10) 

the rows of H can be identified as the generators of the 
stabilizer of a q-ary QECC ED, (29); and so is H B , the 
matrix obtained by deleting a few rows of H. In this way, 
Hr becomes the parity check matrix of a q-ary QLDPC code. 
More importantly, the GF(q 2 ) QLDPC code constructed in 
this way is not necessarily a CSS code. 
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Interestingly, we may build a large number of regular 
QLDPC codes using this modified bicycle construction. The 
trick is to pick the sparse vector (aij)™i^ in such a way that 

|{» : a nH+j ^ 0}| = u (11) 

for all j with the constraint that (n/2) is divisible by n', where 
the symbol | • | denotes the number of elements in the argument 
set. That is to say, we pick the sparse vector (cv)"^ in 
such a way that all the length n/(2n') sub-vectors obtained 
by picking the ith components with i = j (mod n') have 
the same Hamming weight u. Then it is easy to check that 
the parity check matrix H constructed is (n'u, 2n'u)-regular. 
And, by deleting the (in' + j)th row of H for i G N, j G J 
where J is a proper subset of {1,2,- •• ,n'}, the resulting 
parity check matrix Hb corresponds to a ([n 1 — \J\]u, 2n'u)- 
regular g-ary QLDPC code. Note that the proportion of rows 
in H that are removed to obtain Hb equals \J\/n'. Thus, 
Hb has n columns and n(n' — \ J\)/(2n') rows so that 
it encodes n — n(n' — \J\)/(2n') qudits. For instance, let 
q = 2,n = 12, n' = 3, (a,) = (1, 0J4, ui 2 , 0, 0, 0) where 0J4 
is a primitive element in GF(A), and J = {3}. Then our 
construction gives the (2, 6)-regular binary QLDPC stabilizer 
(but non-CSS) code 
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Recall that for a (d v , d c ) -regular QLDPC code with code- 
word length n, the number of non-zero elements in its parity 
check matrix H is d v n. This number is also equal to the 
number of rows of H times d c . Thus, the (quantum) rate of 
the (d v , <i c )-regular QLDPC code is greater than or equal to 
1 — d v /d c , where the equality holds if any only if the rows 
of H are linearly independent over GF(q). In our subsequent 
study, we only consider those £Ts with full row rank so that 
their rate is equal to 1 — d v /d c . Surely, this extra constraint 
on the choice of H is not very restrictive as our construction 
is likely to give H with full row rank anyway. 

Note that for a typical sparse vector (on)™!^ satisfying 
Eq. (fTTT l. the number \{i : ai = /3}\/(n/2) is about the 
same for all /3 £ GF(q 2 ) \ {0}. To summarize, we have 
succeeded in constructing a large number of regular g-ary 
QLDPC codes. The construction is simple and efficient: We 
need a (pseudo-)random number generator to generate the 
sparse vector (a;)™fj. And the stabilizer of our modified 
bicycle construction can be specified from and the 

information regarding which rows to delete. Thus, at most 
0(n) classical bits of storage space are required to specify 
our regular QLDPC codes. Note further that the almost equal 
probability of occurrence of non-zero elements in (aj)™^ and 
the regularity of our QLDPC codes are two of the reasons why 
our QLDPC codes are reasonably effective to combat quantum 
errors. 



C. Belief Propagation Algorithm For Quantum Stabilizer 
Codes 

Similar to classical LDPC code, a QLDPC code can be 
represented by the so-called Tanner graph ll22l . ll23ll . Let C be 
a QLDPC code with parity check matrix H encoding each k 
qudits of information as an n qudit state. Its associated Tanner 
graph is a bipartite graph with vertex set V — Vi U V%. Each 
variable node in V\ is associated with a qudit of the code 
represented by a column of H; and each check node in V2 is 
associated with a generator of the code represented by a row 
of H. There is an edge linking i <G V2 and j E V\ if and only 
if //,., 0. 

Many efficient approximate decoding strategies for classical 
LDPC codes can be regarded as message passing algorithms 
executed on the corresponding Tanner graph. Famous for its 
linear runtime in the codeword size n provided that the error 
probability of each bit is independent, belief propagation is 
one of the most commonly used message passing algorithm 
in which the messages passed between nodes in a Tanner graph 
are conditional probabilities [19|, |20|, [21 J. More importantly, 
belief propagation algorithm is also applicable to quantum 
stabilizer codes whose generators of the stabilizer is sparse. 
Moreover, its efficiency also scales linearly with n in case 
the error probability of each qudit is independent. Actually, 
a similar decoding scheme for QLDPC and for graph states 
can be found in Refs. [23 1 and l30l . respectively. And the 
presentation below is adapted from our earlier unpublished 
manuscript l22l . 
• Since the belief propagation algorithm is also applicable to 
GF(q 2 ) stabilizer codes, we explicitly write down this more 
general situation here. By passing the messages between the 
nodes, the task of the belief propagation decoding algorithm 
is to infer a tentative decoding x. That is to say, x is the most 
likely value of error experienced by the shared EPR pairs based 
on the measured error syndrome vector 

s = (si)iev 2 = (^2( H ij\ej))iev 2 , (13) 

where the check node Si 6 GF(p) is the ith component of the 
syndrome s, ej is the error experienced by the variable node 
Xj, and (-|-) is the skew-symmetric inner product defined in 
Eq. ©. We call e = (ej)j^Vi the noise vector of the state 
shared by the sender and the receiver. 

The messages consist of two types of conditional probabil- 
ities Qfj and Rf^ associated with each non-zero entry in the 
parity check matrix H for all a g GF(q 2 ). To aid discussions, 
we call the jth component of the tentative decoding vector x 
the variable node Xj 6 GF(q 2 ). The quantity Qf^ approxi- 
mates the belief that the qudit Xj has experienced the error 
a 6 GF(q 2 ) given the messages received from all its checks 
other than i. And the quantity Rf^ is the probability of check i 
being satisfied given that the variable node Xj has experienced 
an error in the state a G GF(q 2 ) and the components of 
x other than Xj have a separable distribution given by the 
probabilities Q^'s. 

Initially, each message is set to the prior probability f" 
that Xj has experienced an error a. In situation of our interest, 
/" is a quantity of the quantum channel linking the two parties 
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who would like to perform entanglement distillation. In each 
step, the quantities Rf, are updated according to the equation 



E 



x' :x -—a 



(14) 



Pr( Si \x') J] Q% 

where j\f(i) = {j : Hij ^ 0} denotes the set of variable nodes 
participating in the check i and 

_ , . f 1 if x 1 satisfies the check i, 

Pr(,Sj \x ) = < _ 

[0 otherwise. 

That is to say, 



(15) 



Pr( Si \x') 



■H £ (^|4), s< -(^.|a)(|l6) 

u'eAT(i)\{j} 



where 



1 if a; = y, 
otherwise, 



(17) 



is the Kronecker delta. 

For QLDPC stabilizer codes, Eq. (fl4l can be computed ef- 
ficiently using a fast-Fourier-transform-like recursive iteration. 
In other words, we observe that 



Rfj — R 



(18) 



where 

Rij;J,b 



E 

{x':j'eJ} 




I IK/' 



(19) 

for all e GF(p). Then we can evaluate Eq. (TBI by 
recursively applying the identity 

Rij;J,b — E Rij;Ji;cRij;J 2 ,b-c (20) 
ceGF(p) 

for any partition {Ji, J2} of the set J with \J%\ ps | J 2 | until 
I J I = 1. (And surely for J = {j'}, Rijj.b can be calculated 
directly using Eq. JT8l.) 

After computing Rfj efficiently, each check node Sj sends 
the message Rfj to the variable node Xj for all j £ 
Next, each variable node updates the messages 



>'eM(i)\{«} 



(21) 



according to the information R"j'$ from check nodes s^'s for 
all i' £ M(j) \ {i}, where M(j) = {i : ffy 7^ 0} is the 
set of checks involving variable node a; 3 . The normalization 
constants (fiij's ensure that the sum of conditional probabilities 

J2aeGF(q 2 ) Qij = 1- 

After each round of message passing, we compute the 
pseudo-posterior probabilities 



Qf = W II R "v 

iEM(j) 



(22) 



where <pj is a normalization constant making J2 a Q'j = !■ 
We now set Xj, the jth component of the tentative decoding 
x, to a if Qf > Q? for all b £ GF(q 2 ). And we denote this 
operation by 

(23) 



~ _ argmax s^a 
X 3 ~ aeGF(q 2 ) ^3 ' 

The decoding algorithm iterates until either the tentative 
decoding x is consistent with the observed syndrome (that 
is, Si = Y^jeVi (Hij\xj) for all i £ V2) or a pre-determined 
maximum rounds of message passing is reached. 

To summarize, the belief propagation algorithm can be 
applied to decode QECC codes because its decisions depend 
only on our prior assumptions of the noise of the channel 
and the measurement results for an independent noise channel 
of the error syndrome. Moreover, it decodes QLDPC codes 
efficiently partly because each summand in Eq. (TBI can be 
expressed as a sum of products. 

D. Detailed Procedure Of Using Adaptive Quantum Low 
Density Parity Check Code 

The detailed procedure of using adaptive QLDPC code to 
distill the final EPR pair is shown below. Our procedure is 
based on a much more general framework of using adaptive 
QLDPC code to distill entanglement (reported in our unpub- 
lished work in Ref. l22l ). 

[Adaptive Entanglement Distillation Using Quantum Low 
Density Parity Check Codes And Belief Propagation] 

1) Alice and Bob randomly pick an (8, 16) -regular QLDPC 
code H[2] with codeword size 960 using our generaliza- 
tion of MacKay et al. 's bicycle construction reported in 
Sec. IIII-BI By deleting a few parity checks from H[2] 
using the method reported in Sec. IIII-BI they obtain a 
(6, 16)-regular QLDPC code H[l], which is a subcode 
of H[2]. 

2) Alice and Bob measure their corresponding shares of 
the noisy EPR pairs using the QLDPC code H[l] 
with the help of (unentangled) ancillas. Alice sends her 
measurement results to Bob. And then Bob computes 
the error syndrome s[l](e), where e is the noise vector 
of the state they shared. 

3) Using the belief propagation algorithm and Eq. d22"i >. 
Bob computes the posterior marginal probabilities Q? [1] 
that his jth qubit has experienced an error a £ GF(4) 
given the messages passed from all its check nodes. 
From the posterior marginal probabilities, Bob deduces 
a tentative decoding x[l] based on the measured error 
syndrome s[l](e). 

4) If a tentative decoding x[l] satisfying JT[l]sc[l] = 
s[l](e) is found within the first m max = 5 rounds of 
message passing, then x[l] is also a self-consistent error 
vector. (Just like the case of decoding classical QLDPC 
codes using belief propagation algorithm, the choice 
of m max does not sensitively affect the performance 
provided that it is of order of unity.) In this case, what 
Bob needs to do is to perform the error correction by 
applying the additive inverse of the pseudo-posterior 
noise vector, namely — sc[l], to his qubits. The resulting 
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Fig. 1. An illustrative example of adaptive entanglement distillation using 
the code H[l] = (lu4 0J4 104). In case the error can be corrected by H[l], 
decoding circuits in (a) and (b) are equivalent up to permutation of entangled 
qubits. But in case the error cannot be corrected by H[l], the results of the 
two decoding circuits may differ due to the error propagation in the decoding 
process. 



state is likely to be copies of almost perfect encoded 
EPR pairs. Finally, Alice and Bob finish up by running 
the encoding circuit for H[l] backward to distill copies 
of almost perfect EPR pair. (See Fig. [T^.) This marks 
the end of our scheme. 
5) If Zf [l]a;[l] 7^ s[l](e) even after m max rounds of belief 
propagation message passing, then Alice and Bob substi- 
tute the QLDPC code H[2] for H[l] and repeat steps |2]- 
|4] again. If a tentative decoding still cannot be found 
(that is, Zf[2]x[2] 7^ s[2](e) even after m max rounds of 
belief propagation message passing), then Alice and Bob 
discard those EPR pairs whose beliefs of finding valid 
decodings are low. More precisely, they throw away 
the jth EPR pair if the entropy of the pseudo-posterior 
probabilities 



h 4 (Q 3 [2}) 



h 4 {{Q1[2]:aeGF{±)}) 

Q?[2]log 2 Q«[2] (24) 



*GGF(4) 



is greater than the entropy threshold = S(W po ) 
-(1 - po) log(l - po) - po log(p /3). 



The detailed procedure to throw away a EPR pair 
requires attention. According to the belief propagation 
algorithm, Alice and Bob believe that the most probable 
error experienced by the jth EPR pair is ctj [2] = {a [2] g 
GF{4) : Qf[2] > Q| [2],Vj9 £ GF(4)}. So Bob first 
applies —ay [2] to his share of the jth EPR pair. Surely, 
there is more than one possible encoding circuit for if [2] 
and running any of these encoding circuits backward can 
correctly decode H[2] in the absence of noise. Since the 
tentative decoding cannot be found, in order to minimize 
the decoding error, Alice and Bob run the encoding 
circuit backward in which the sum of the entropies of the 
pseudo-posterior probabilities for the message qubits are 
minimized. After applying this decoding circuit, they can 
throw away those shared EPR pairs with high entropy 
of the pseudo-posterior probabilities. (See Fig. Q]) 

The choice of codes and parameters in the above distillation 
procedure requires explanation. Note that the rate of H[l], 
which equals 5/8, is quite high. And at the same time, our 
Monte Carlo simulation shows that it is very effective to 
correct most errors when the quantum error rate is less than 
about 1%. Thus, H[l] is our main ingredient of obtaining a 
high yield. In the event that tentative decoding x[l] cannot 
be found, by switching to the code H[2], which has a higher 
error-correcting capability at the expense of a relatively low 
rate of 1/2, we hope to maintain a reasonable yield without 
lowering the fidelity of the resulting EPR pairs too much. And 
in the worst possible situation that the tentative decoding x[2] 
cannot be found, we switch to a much lower yield ED-like 
method. We hope that this adaptive combination of QLDPC 
codes combined with the recurrence method can effectively 
and efficiently distill EPR pairs. 

Surely, the above method is very flexible and can be easily 
generalized and modified. For instance, one may consider 
using multiple levels of QLDPC codes each with very different 
rates. Unfortunately, the average error-correcting capability 
of a QLDPC code with large codeword size can only be 
numerically simulated to date. That is why various authors use 
numerical simulations to evaluate the performance of QLDPC 
codes fl3), 03), (24), (B), (27). Thus, the search for the 
highest yield recurrence method with the final random hashing 
being replaced by an efficiently decodable adaptive quantum 
code is a very difficult task. Nonetheless, we have tried to 
play around with a few efficiently decodable codes and find 
that the currently reported one gives the highest yield. 

IV. Yield Of Practical Entanglement Distillation 
Using Recurrence Method 

We study the (optimal) yield of our recurrence-method- 
based ED procedure using a few efficiently decodable codes to 
distill a collection of Werner states W Po . Here the term optimal 
refers to the maximum yield obtained by tuning the number 
of rounds of recurrence and the measurement basis used in 
each round of recurrence. For all but the adaptive QLDPC 
code we have studied, the optimal yield D can be calculated 
analytically. While for the adaptive QLDPC code, the yield 
is computed based on Monte Carlo simulations. Actually, we 
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focus on the final step by studying the performance of the 
adaptive QLDPC code by Monte Carlo simulations. And once 
this performance is established, the optimal yield D can be 
deduced in the same way as other efficiently decodable block 
codes. We use the following method to find out the perfor- 
mance of the adaptive QLDPC code. For a given quantum 
error rate of the input noise vector, we numerically compute 
the resultant quantum error rate and the (partial) yield when 
we feed these noisy qubits into the adaptive QLDPC code with 
belief propagation decoding and then run the encoding circuit 
backward. To obtain a reliable estimate, we take the average 
over 5 x 10 7 independently generated noise vectors for each 
input quantum error rate. After performing these Monte Carlo 
simulations, we find that up to an error of 2% or less, the 
resultant quantum error rate of the qubits e out and the partial 
yield L> part iai are given by: 



log 10 (e out ) « -5.01 + 93.70e in 



and 



^partial « 0.628 - 0.0032e 



205.3e in 



(25) 



(26) 



whenever the input quantum error rate e m is in the interval 
[0.0025,0.015]. 

Fig. |2] shows the yields D as a function of po when the 
standard random hashing code is replaced by a number of dif- 
ferent efficiently decodable codes and when the quantum error 
rate of the distilled EPR pairs is less than p th = 2.0 x 10~ 5 . 
In other words, the entropy of the distilled EPR pairs is at 
most 3.7 x 10~ 4 . (Note that the yield is about the same when 
the standard random hashing procedure is replaced by the so- 
called two-copy breeding proposed introduced by Vollbrecht 
and Verstraete in Ref. |8). So, we do not show it in Fig. [2] 
to avoid overcrowding the graph. Since the error of using 
Eqs. (|25l l and d26l l to evaluate the performance of the adaptive 
(8, 16)-regular QLDPC is about 2%, we decide not show the 
corresponding error bars in the figure.) 

One distinctive feature of the pq — D curves are that, except 
for the case of using random hashing (and also breeding), they 
are discontinuous in various places. Since all the efficiently 
decodable codes we have investigated are not universal, each 
discontinuity in the po — D curve corresponds to a change 
in the number of recurrence used in order to achieve the 
optimal yield. In contrast, the po — D curve for the universal 
random hashing is continuous with several cusps. Each cusp 
corresponds to a change in the number of recurrence used in 
order to achieve the optimal yield. 

Another observation is that the yield when using random 
hashing (and also breeding) outperforms all the other codes we 
have studied. This is not surprising because the rates of all the 
other codes we have investigated are lower than that of random 
hashing and breeding. In fact, this is the price Alice and Bob 
have to pay in order to make the entanglement distillation 
scheme practical. 

The most important observation deduced from Fig. [2] is 
that the yield using the adaptive (8, 16) -regular QLDPC code 
outperforms all the other efficiently decodable codes we 
have investigated. To show the performance of the adap- 
tive (8, 16)-regular QLDPC code in a clearer way, we use 
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Fig. 2. The yield D of the recurrence method using various efficiently 
decodable codes as the last step to distill a collection of Werner states W P0 
as a function of po ■ The quantum error rate of the distilled EPR pairs is less 
than or equal to p t h = 2.0 X 10 — 5 . The solid curve is the case of using the 
adaptive (8, 16)-regular QLDPC code with codeword size 960 and the dotted 
curve is the case of using random hashing plotted for comparison. Fig. (a) 
and (b) show also the yields for a few quantum GF(&) Hamming codes and 
CSS codes constructed from classical GF(2) Hamming codes, respectively. 
Fig. (c) depicts also the yields for the [3, 1, 3] classical majority vote code, a 
few classical GF{2) Hamming codes and the [16, 8, 5] BCH code. 



the same data in Fig. [2] to plot a new graph. This new 
graph (Fig. [3]) plots the ratio of the yield using the adaptive 
(8, 16)-regular QLDPC code to the best yield using other 
efficiently decodable codes we have investigated against po. 
Figs. |2] and [3] show that over a wide range of values of 
Po, the yield of our adaptive (8, 16) -regular QLDPC code 
with n — 960 is at least 25% better although occasionally 
the [[21,15,3]], [[85,77,3]] GF(4) quantum Hamming codes 
and the [[31,21,3]], [[63,51,3]] and [[127,113,3]] CSS codes 
constructed from the corresponding GF(2) classical Hamming 
codes win. Moreover, Fig. [2] shows that no classical code we 
have studied outperforms the adaptive (8, 16)-regular QLDPC 
code in terms of the yield D. These discoveries suggest that 
efficiently decodable degenerate codes may not give a high 
yield when used with recurrence method. Fig. |2] also depicts 
that although the yields of using any family of codes, such as 
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Fig. 3. The ratio of the yield for using the (8, 16)-regular QLDPC code with 
codeword size 960 to the best yield using other efficiently decodable codes 
selected in this study against p . 



the [[(4*-l)/3,(4*-l)/3-2t,3]] GF(4) quantum Hamming 
codes generally decreases as t increases, there are plenty of 
exceptions violating this general trend. This complexity orig- 
inates from the complicated interplay between two opposing 
effects, namely, as t increases, the code rate increases while the 
quantum error rate of particles after applying the code reduces 
less effectively. In this respect, it seems rather unlikely to find 
an optimal efficiently decodable code. Lastly, the high yield of 
recurrence method when coupled with our adaptive QLDPC 
code implies that our strategy of adaptively combining a high 
rate QLDPC code with another compatible lower rate QLDPC 
code together with dropping a few qubits in case the tentative 
decoding cannot be found is reasonably effective. 



V. Conclusions And Outlook 

In conclusion, we have pointed out the need to replace 
universal random hashing and breeding methods by an ef- 
ficiently decodable code in order to make an entanglement 
distillation scheme practical. As a pilot study, we have in- 
vestigated the yields of the recurrence method using various 
efficiently decodable codes as substitutions for random hashing 
or breeding methods to distill EPR pairs from a collection of 
Werner states W po . We find that among the codes we have 
studied, the best yield over almost all values of p is achieved 
by an adaptive QLDPC code with the possibility of dropping 
a few low confidence qubits in the worst case scenario that 
the tentative decoding cannot be found. Our finding shows 
that adaptive QLDPC codes are useful resources in quantum 
information processing. 

A number of followup researches along this line have to be 
done. For instance, both the yields of other practical bipartite 
and multipartite entanglement distillation schemes and the 
choice of multiple levels of adaptive QLDPC codes require 
thorough investigations. 
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